116.52.118.52 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: ChinaNet Yunnan Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	The IP has triggered Cloudflare WAF. CF-Ray: 5435ea1e4817eb19 \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: drop \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: doku.skk.moe \| User-Agent: Mozilla/5.084743666 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 05:13:51

Type

Details

Datetime

attackbots

The IP has triggered Cloudflare WAF. CF-Ray: 5435ea1e4817eb19 | WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 | WAF_Kind: firewall | CF_Action: drop | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: doku.skk.moe | User-Agent: Mozilla/5.084743666 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-12 05:13:51

Comments on same subnet:

IP	Type	Details	Datetime
116.52.118.253	attack	Unauthorized connection attempt detected from IP address 116.52.118.253 to port 4712 [T]	2020-04-15 02:07:01
116.52.118.239	attack	The IP has triggered Cloudflare WAF. CF-Ray: 5413a39aae84e7ad \| WAF_Rule_ID: 1112824 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: blog.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SM-N900T Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 03:35:34

Type

Details

Datetime

116.52.118.253

attack

Unauthorized connection attempt detected from IP address 116.52.118.253 to port 4712 [T]

2020-04-15 02:07:01

116.52.118.239

attack

The IP has triggered Cloudflare WAF. CF-Ray: 5413a39aae84e7ad | WAF_Rule_ID: 1112824 | WAF_Kind: firewall | CF_Action: challenge | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: blog.skk.moe | User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SM-N900T Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-08 03:35:34

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 116.52.118.52
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32652
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;116.52.118.52.			IN	A

;; AUTHORITY SECTION:
.			468	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121101 1800 900 604800 86400

;; Query time: 117 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Dec 12 05:13:47 CST 2019
;; MSG SIZE  rcvd: 117

Host info

52.118.52.116.in-addr.arpa domain name pointer 52.118.52.116.broad.km.yn.dynamic.163data.com.cn.

Nslookup info:

;; Got SERVFAIL reply from 183.60.83.19, trying next server
Server:		183.60.82.98
Address:	183.60.82.98#53

** server can't find 52.118.52.116.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
185.60.40.210	attackbots	Jan 8 09:19:41 lnxweb62 sshd[27323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.60.40.210 Jan 8 09:19:43 lnxweb62 sshd[27323]: Failed password for invalid user vzf from 185.60.40.210 port 48362 ssh2 Jan 8 09:20:59 lnxweb62 sshd[28157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.60.40.210	2020-01-08 18:50:06
121.229.0.154	attackbotsspam	Unauthorized connection attempt detected from IP address 121.229.0.154 to port 2220 [J]	2020-01-08 19:03:58
177.139.125.6	attackspam	Automatic report - Port Scan Attack	2020-01-08 18:36:22
2.180.72.250	attackbotsspam	01/07/2020-23:47:56.979370 2.180.72.250 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433	2020-01-08 18:39:36
67.205.153.16	attack	Unauthorized connection attempt detected from IP address 67.205.153.16 to port 22	2020-01-08 18:49:38
112.33.253.165	attackspambots	2020-01-05T18:01:34.8756901495-001 sshd[53250]: Invalid user test from 112.33.253.165 port 47732 2020-01-05T18:01:34.8786161495-001 sshd[53250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.33.253.165 2020-01-05T18:01:34.8756901495-001 sshd[53250]: Invalid user test from 112.33.253.165 port 47732 2020-01-05T18:01:37.6173251495-001 sshd[53250]: Failed password for invalid user test from 112.33.253.165 port 47732 ssh2 2020-01-05T18:12:10.4942901495-001 sshd[53697]: Invalid user maven from 112.33.253.165 port 48020 2020-01-05T18:12:10.4972511495-001 sshd[53697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.33.253.165 2020-01-05T18:12:10.4942901495-001 sshd[53697]: Invalid user maven from 112.33.253.165 port 48020 2020-01-05T18:12:12.8841201495-001 sshd[53697]: Failed password for invalid user maven from 112.33.253.165 port 48020 ssh2 2020-01-05T18:16:07.0672901495-001 sshd[53814]: ........ ------------------------------	2020-01-08 18:55:04
124.156.169.7	attack	leo_www	2020-01-08 18:52:38
159.192.70.92	attack	1578469877 - 01/08/2020 08:51:17 Host: 159.192.70.92/159.192.70.92 Port: 445 TCP Blocked	2020-01-08 19:00:14
69.94.156.6	attackbots	Jan 8 05:47:09 grey postfix/smtpd\[27038\]: NOQUEUE: reject: RCPT from dust.nabhaa.com\[69.94.156.6\]: 554 5.7.1 Service unavailable\; Client host \[69.94.156.6\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[69.94.156.6\]\; from=\ to=\ proto=ESMTP helo=\ ...	2020-01-08 19:06:45
112.35.57.139	attackspambots	$f2bV_matches	2020-01-08 18:48:32
183.155.123.95	attackbots	unauthorized connection attempt	2020-01-08 18:35:19
43.240.21.31	attack	1578458874 - 01/08/2020 05:47:54 Host: 43.240.21.31/43.240.21.31 Port: 445 TCP Blocked	2020-01-08 18:32:56
178.32.113.68	attackbots	Jan 7 23:08:03 cumulus sshd[15525]: Invalid user rtvcm from 178.32.113.68 port 58800 Jan 7 23:08:03 cumulus sshd[15525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.113.68 Jan 7 23:08:06 cumulus sshd[15525]: Failed password for invalid user rtvcm from 178.32.113.68 port 58800 ssh2 Jan 7 23:08:06 cumulus sshd[15525]: Received disconnect from 178.32.113.68 port 58800:11: Bye Bye [preauth] Jan 7 23:08:06 cumulus sshd[15525]: Disconnected from 178.32.113.68 port 58800 [preauth] Jan 7 23:20:59 cumulus sshd[16609]: Invalid user developer from 178.32.113.68 port 47644 Jan 7 23:20:59 cumulus sshd[16609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.113.68 Jan 7 23:21:01 cumulus sshd[16609]: Failed password for invalid user developer from 178.32.113.68 port 47644 ssh2 Jan 7 23:21:01 cumulus sshd[16609]: Received disconnect from 178.32.113.68 port 47644:11: Bye Bye [preau........ -------------------------------	2020-01-08 19:05:43
124.6.158.62	attackbotsspam	01/08/2020-05:47:18.904810 124.6.158.62 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433	2020-01-08 18:59:25
85.105.92.139	attackspambots	Automatic report - Port Scan Attack	2020-01-08 18:30:50

Recently Reported IPs

58.248.201.238	58.248.201.129	49.7.4.162	49.7.4.154
42.200.181.241	46.62.6.196	2a01:4f9:2b:464:1::2	36.110.199.149
36.32.3.105	27.224.136.162	14.199.117.154	1.202.112.54
223.166.74.245	223.166.74.244	223.166.74.152	222.94.163.216
222.82.60.53	222.82.55.164	221.234.238.226	221.11.20.169